Christopher Wellons bf718c5d23 Move code-signing into the build pipeline ...

Sign every PE inside the toolchain (~250 .exe and .dll), pack, then
sign the resulting self-extracting archive. All signing runs at
docker run time so the bulk of the build remains fully cacheable
and secrets never enter image layers.

Stage layout:
- dl-aas-sign / build-aas-sign: SHA-pinned source tarball with
  vendored mbedtls + nlohmann/json, built with the base image's
  Debian gcc.
- final: assembly only (drop the trailing 7z + CMD).
- signed (new): COPY aas-sign + sign-and-pack.sh, CMD runs the
  script at docker run time. Reads AZURE_CLIENT_ID/TENANT_ID and
  the GitHub OIDC env vars from -e flags.
- pack (new, default target): RUN 7z + CMD cat sfx archive.
  Behaviorally identical to the old final.

The release workflow rebuilds --target signed for each arch
(reusing the same GHA cache scope as the unsigned pack build),
then docker runs the image to produce the signed package on
stdout.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-05-03 08:59:34 -04:00

..

build.yml

Move code-signing into the build pipeline

2026-05-03 08:59:34 -04:00